Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: xpjohn on November 12, 2005, 12:04:22 AM

Title: Incoming clean message not on all emails
Post by: xpjohn on November 12, 2005, 12:04:22 AM
I am using Avast Home and just recently it has stopped inserting the "Clean message" on some of my incoming emails but not all.
One particular friend who sends me emails reguarly has no incoming messages on the emails that she sends me but strange thing is, the message appears when she forwards an email that has been sent to her from somebody else.
The emails from this friend always included the message at the bottom of the email in the past, but recently this hasn't been the case.
My friend is also using Avast and the emails that she sends me directly do not contain any outgoiing clean message, the whole thing is blank at the bottom. No outgoing or incoming message. But the messages are there when the email is forwarded from her but not when she sends a direct email just to me.
Emails that I send to her have both outgoing and incoming clean messages on the email.
I also sent myself an email from my gmail account and the same thing happens, no incoming "clean" message on the email, just blank.
I also sent myself another email from another email account that I have with Hotmail and the incoming message is on the email.
The messages always appeared previously, its only happened recently but most of my emails have the message inserted.
Why is this happening and what do I do to change it to work on all emails.
I have both incoming and outoging messages ticked to be inserted in all emails.
My email client is Mozilla Thunderbird and has worked great with Avast up until now.
I am sure Avast is scanning these emails because the little globe spins when I receive them.
Title: Re: Incoming clean message not on all emails
Post by: Lisandro on November 12, 2005, 01:46:36 AM
Which is your operational system?
Are you talking about txt or html email messages?
On the outgoing, aren't you checking the 'Sent items' folder, are you?
Title: Re: Incoming clean message not on all emails
Post by: alanrf on November 12, 2005, 01:57:37 AM
Since you are using the nickname xpjohn I am guessing that you are on Windows XP.

What kind of email accounts are you receiving in Thunderbird?

Are they regular POP3 email accounts where you are using port 110?

Are you receiving your Gmail account in Thunderbird?

Are you using third party programs to receive Webmail (Hotmail, Yahoo etc) mail into Thunderbird?

Title: Re: Incoming clean message not on all emails
Post by: xpjohn on November 12, 2005, 11:08:50 PM
Yes I am using XP home and its a POP account.
No not checking my sent folder for outgoing mail, I know the messages dont show up in the "sent" folder"
I dont have my gmail go to my thunderbird account. The problem is with both html and txt emails but only from some senders, not all.
This problem has only just recently occured and for no apparant reason.
I have noticed that all emails with attachments have the messages both incoming and outgoing from my friend mentioned above and any mail that she forwards to me from other senders also have the messages.
Title: Re: Incoming clean message not on all emails
Post by: DavidR on November 13, 2005, 12:36:46 AM
First I would suggest that you do a manual program update as there is a new version of avast available (4.6.731), once update you will need to boot. There have been some changes to the email scanner so perhaps it might help.

Then confirm in the Internet Mail settings that you are in fact asking for a clean note to be inserted in outbound and inbound (if you want that also) emails.

If so, send yourself a test email and check that it is being scanned (avast On-Access, Internet Mail) both outbound and inbound. You should be able to see that it is being scanned from the email headers (properties), something like this for both outbound and inbound email.
X-Antivirus: avast! (VPS 0545-1, 09/11/2005), Outbound message
X-Antivirus-Status: Clean
Title: Re: Incoming clean message not on all emails
Post by: Lisandro on November 13, 2005, 02:31:37 AM
xpjohn, if you don't have the X-Antivirus tags like David described I think you're not getting your mail scanned  :'(
First of all, Gmail uses SSL (Secure Socket Layer) connections and avast mail scanner can only support SSL if you follow settings like here: http://forum.avast.com/index.php?topic=10428.0

Did you install a proxy program called Stunnel and the OpenSSL drivers?
Title: Re: Incoming clean message not on all emails
Post by: alanrf on November 13, 2005, 04:46:00 AM
Tech,

xpjohn said above that he does not have his gmail delivered to his Thunderbird client - so gmail is not an issue.
Title: Re: Incoming clean message not on all emails
Post by: alanrf on November 13, 2005, 05:04:51 AM
Messages can be a little confusing when you receive forwarded mail from another avast user, as I do too.

I rather think that in the case of your friend:

When she receives a message the "incoming avast scanned text" is inserted.  She forwards the message to you and it still has the "incoming avast scanned text" in it and that is what you see.

When she sends you a brand new message it has no avast text in it and your system is not adding any so you do not see it.

As DavidR has suggested, first update to the most recent program version of avast.

Then:

1) just check for sure that the port you have set for the POP3 account in Thunderbird is 110

2) on the Internet mail provider in avast click on customize.

3) on the POP tab make sure "Scan inbound mail" is checked

4) on the Redirect tab make sure port 110 shows in the "POP:" box

5) on the Advanced tab check the "Show detailed info on performed action" box. 

6) click on "OK"

Item (5) will cause avast to show a little popup window above the systray as you receive your Thunderbird mail - if it is scanning the mail - with the subject of the email being scanned.   

Let us know how it goes.

Just by the way, have you recently installed any email spam filter or perhaps some kind of network accelerator software?
Title: Re: Incoming clean message not on all emails
Post by: Lisandro on November 13, 2005, 12:45:03 PM
Tech, xpjohn said above that he does not have his gmail delivered to his Thunderbird client - so gmail is not an issue.

I dont have my gmail go to my thunderbird account.

 :-[
I lost the don't... I miss the '  :)
Title: Re: Incoming clean message not on all emails
Post by: xpjohn on November 15, 2005, 01:49:17 AM
Thanks for replying guys. I been away for a couple of days so sorry about the delay.

I am still getting the problem. I have sent myself emails both in plain text and html and all that I send myself have the outgoing and incoming messages on them.
I have had my friend send me emails text and html and no messages. However when I check it out, in the on access scanner, it shows that the email was in fact, scanned.
However when she forwards mail it always has the messages. mostly has 3 messages. first one is her incoming clean message and secondly the outgoing clean message when she forwards it on to me and thirdly my own incoming clean message. she has done this while we are both online. So we send emails back and forth to check it out.
I have observed emails she sends me (not only forwarded ones) with any kind of attachment, pictures for instance, do have the outgoing and incoming messages on the email when I receive it. even if its only a smiley face or something simple I then get the messages.
She gets all my messages with my outgoing mail clean on them regardless if they are text or html.
Same with gmail, I sent myself an email from gmail and inserted a picture in the email and sure enough incoming clean message was there. but not when I just send a message with no attachments.

I have checked all the things suggested here and all seems okay. POP port is 110 SMTP port 25
I dont quite understand when you say I am suposed to see a scanned message in the headers of my emails to the effect they have been scanned. Where does this appear, in the email itself of somewhere else.

Software version is 4.6.731.  In the meantime if anyone can think of anything I should try, please let me know
Title: Re: Incoming clean message not on all emails
Post by: alanrf on November 15, 2005, 02:41:10 AM
In Thunderbird just select a message, from the top menu select "View" and then in the dropdown menu select "View message source"

It will open up a window with the source lines of the email.  Somewhere in there you should see two lines like:

Quote
X-Antivirus: avast! (VPS 0546-0, 11/14/2005), Inbound message
X-Antivirus-Status: Clean
Title: Re: Incoming clean message not on all emails
Post by: xpjohn on November 15, 2005, 06:14:56 AM
Thanks have done that and it shows that the message was scanned, in fact the messages actually appear there just like they should in the email but they are still not showing up in the emails.
Title: Re: Incoming clean message not on all emails
Post by: alanrf on November 15, 2005, 08:14:12 AM
xpjohn

please just allow me to ask for your confirmation.

You are reporting that you are seeing emails in Thunderbird that contain the:

X-Antivirus: headers but they do not contain the related antivirus scanned/clean texts when that is the option you have requested. 

Is that correct?

Your last post could be misunderstood to say that the whole email is not showing up.  I just want to be clear what you see.  A message missing the "scanned text" you have selected or the message not appearing at all. 

Please make it clear for us. 

Thanks,

Alan
Title: Re: Incoming clean message not on all emails
Post by: xpjohn on November 15, 2005, 09:03:56 PM
Sorry Alan I didn't make it very clear.
I did what you suggested to see if the emails were actually being scanned and it shows the inbound and outbound messages in that window also the contents of the email text.
But when I open the email properly, the body contents of the email is there but the messages for the virus scan dont show up in the email.
Simply, I am getting everything in the email except for the messages at the bottom "inbound" or "outbound" clean.
Hope this makes it clearer.
Title: Re: Incoming clean message not on all emails
Post by: YLAP on November 15, 2005, 09:51:42 PM
I had this problem when I've used my personal digital certificate. All signed messages were prevented from any changes, so I think avast was unable to insert anything into the message. the same was with incoming digitally signed messages...
Title: Re: Incoming clean message not on all emails
Post by: alanrf on November 15, 2005, 10:52:28 PM
xpjohn,

thanks for the clarification. 

On the outbound messages - you cannot see the outbound scanned text in the messages in the sent folder because the scanning of the message and the adding of the outbound text only happens after the mail has been sent by Thunderbird.  So the outbound scanned text is only seen by the recipient of the message. 

On the inbound side - as =YLAP= says there are circumstances where the message format appears to confuse avast and prevent the insertion of the "cleaned" status information.  A short time ago I researched a case where a third party program involved in mail delivery added some of those X- headers that upset avast and stopped all insertion of scanned information.  In that case I managed to get the program modified so that the avast messages worked again.

I am wondering if your ISP is adding something to the message such that in a simple plain text message, avast misses whatever it is in the message that triggers avast to add the "scanned text". 

Here's the source of a small message I just sent to my POP3 account from my Hotmail account.  You may want to compare with yours and see if there any major differences. 

Quote
From - Tue Nov 15 13:28:33 2005
X-Account-Key: account1
X-UIDL: 20051115212720r2200dckvue0004rt
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Received: from hotmail.com (bay103-f6.bay103.hotmail.com[65.54.174.**](misconfigured sender))
          by rwcrmxc22.comcast.net (rwcrmxc22) with ESMTP
          id <20051115212720r220043vpue>; Tue, 15 Nov 2005 21:27:20 +0000
X-Originating-IP: [65.54.174.**]
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
         Tue, 15 Nov 2005 13:27:20 -0800
Message-ID: <BAY103-F66840C096B36F7F2228A3EA5D0@phx.gbl>
Received: from 65.54.174.200 by by103fd.bay103.hotmail.msn.com with HTTP;
        Tue, 15 Nov 2005 21:27:20 GMT
X-Originating-IP: [67.166.143.**]
X-Originating-Email: [alanxxx@hotmail.com]
X-Sender: alanxxx@hotmail.com
From: "Alan *******" <alanxxx@hotmail.com>
To: alanxxx@comcast.net
Bcc:
Subject: A small text message.
Date: Tue, 15 Nov 2005 13:27:20 -0800
Mime-Version: 1.0
Content-Type: text/plain; format=flowed
X-OriginalArrivalTime: 15 Nov 2005 21:27:20.0299 (UTC) FILETIME=[5C4D4BB0:01C5EA2B]
X-Antivirus: avast! (VPS 0546-2, 11/15/2005), Inbound message
X-Antivirus-Status: Clean

Some text.

_________________________________________________________________
Don’t just search. Find. Check out the new MSN Search!
http://search.msn.click-url.com/go/onm00200636ave/direct/01/



---
avast! Antivirus: Inbound message clean.
Virus Database (VPS): 0546-2, 11/15/2005
Tested on: 11/15/2005 13:28:33
avast! - copyright (c) 1988-2005 ALWIL Software.
http://www.avast.com


Title: Re: Incoming clean message not on all emails
Post by: xpjohn on November 17, 2005, 08:32:16 AM
Thanks alanrf,
Did that and emails are very similar from my hotmail account and incoming clean message was inserted by Avast. I dont seem to have any trouble with hotmail emails but th ones from gmail and my friend.
I alson sent myself an email from gmail with just plain text and the incoming clean message is not on the email.
I compared the 2 source information of the emails and the only real difference I can pick is the email from hotmail states the email content as   text/plain format=flowed
and gmail states content of email as  multipart/alternative

I got no idea what is hapening. guess I will have to live with it.

Title: Re: Incoming clean message not on all emails
Post by: alanrf on November 17, 2005, 09:48:51 PM
xpjohn,

I just conducted some tests sending messages from my gmail account to my pop account and I see what you are describing.

When I send a small text message from gmail to my pop account it is displayed without the avast "scanned clean" text.

When I send the same small text message plus an attachment (in this case a jpg file) the displayed message shows the small text message followed by the picture followed by the avast "scanned clean" text. 

What is happening?

Gmail sends the simple small text message as multipart/alternative.  That means the message actually has two parts inside it, one where the text is presented as plain text and a second where the text is presented in html format.  This is done so that those mail clients that can render html (like Thunderbird) will display the message as it was sent (with colour/fonts etc) while older mail clients which do not render html will display the plain text section only.

avast is actually inserting the "scanned clean" text but is putting it into the plain text section of the message only.  Your Thunderbird setting in View > Message body as > is almost certainly set to "Original HTML".  If you set it to "Plain Text" and look at the Gmail text message again you will see the avast "scanned clean" text.

Now in the case of the text message with an attachment Gmail sends the message as multipart/mixed.  It still contains the multipart/alternative sections for the text but it has an extra body part for the attachment.  In this case avast does not put the "scanned clean" text inside the plain text section but creates an entirely new body part for the "scanned clean" message.  So, Thunderbird then displays the html message text as before, then the attachment and finally the avast "scanned clean message".

Probably the same sort of thing is happening with the messages from your friend's ISP. 

It would appear that there is a slight inconsistency here but I think in the multipart/alternative case there can only be the two parts and so avast has to modify the plain text section.  In the multipart/mixed there is no limit on the number of parts and avast is free to add an extra part containing the "scanned clean" text. 

Hope this helps explain what you are seeing (or not seeing).   
Title: Re: Incoming clean message not on all emails
Post by: Lisandro on November 18, 2005, 01:01:14 AM
Alan, does this occur with the X-Antivirus headers too?
I know it's not the solution but won't be easier just checking the hearders?
Title: Re: Incoming clean message not on all emails
Post by: alanrf on November 18, 2005, 01:11:30 AM
The X-antivirus headers are there in all cases, but they are not seen in a normal message display.

The situation is confusing since in the multipart/alternative messages the avast clean message is only seen in a plain text display.  If the mail client renders html as the preferred choice (as most modern clients do) then the avast clean is not displayed.

So this appears to the user as avast failing to comply with the settings the user has selected.



 
Title: Re: Incoming clean message not on all emails
Post by: Lisandro on November 18, 2005, 01:35:43 AM
Thanks Allan. Very useful explanation.

So this appears to the user as avast failing to comply with the settings the user has selected.
Maybe Alwil team find a way to solve this...
Title: Re: Incoming clean message not on all emails
Post by: alanrf on November 18, 2005, 01:47:42 AM
It could be done but I think it would mean that avast would have to re-write the whole message as multipart/mixed, imbed the multipart/alternative and then add a body part for the avast clean message. 

That's a lot more complex than the way they have chosen to do it. 
Title: Re: Incoming clean message not on all emails
Post by: xpjohn on November 18, 2005, 03:35:59 AM
Thanks a million alanrf, you were absolutely right and when I changed it from original html to plain text the incoming message was in the email that I sent myself from gmail.

this led me to experiment the same way with the emails I get from my friend. incedentally, she uses Outlook Express.
I did the same thing with her emails but still didnt see the message, however, I observed that when I checked simple html or plain text in view/message body as, an attachment called Blank background gif was attached to all the text emails she had sent. Hadnt noticed it before, and I knew she had not included any attachments herself. This attachment icon did not show up in original html.
And there lies the problem with her emails.
I opened up my copy of Outlook Express and tried to simulate the problem that I was getting in her emails. I found  that by going to Tools/options/compose in outlook express and ticking the mail check- box under the heading when composing new html messages the following stationery fonts will be used, I caused the same problem. No ingoing or outgoing clean messages.
And when I reversed this by going back to Tools/options/compose and unticking the mail check- box, the emails now carry the incoming and outgoing clean messages.
It would appear the gmail thing and my friends emails problems was somewhat unrelated and the problem with her emails was with her settings in Outlook Express.

Just thought I would pass this on in case somone else is having similar problems.

Hope I have made this clear.

Thank you so much for your support and indulgence with this problem Alan, you certainly steered me in the right direction and led me to the solution of the problem. Wouldn' have had a clue without your advice.
I appreciate your explaination, certainly helps me to understand a lot more and
a big thanks to everyone else who gave their valuable input to this post. Thanks guys.

John